Cloudanix VulnDB

CVE-2026-29087

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Mar 6, 2026

CISA due date

—

The record

@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middleware does not run but the static file is still served. This issue has been patched in version 1.19.10.

Affected packages

Ecosystem Package Introduced Fixed
npm @hono/node-server 0 1.19.10
Chainguard kibana-9.1 0 9.1.10-r7
Chainguard kibana-9.1-iamguarded 0 9.1.10-r7
Chainguard langfuse-3 0 3.160.0-r1
Chainguard langfuse-3-worker 0 3.160.0-r1
Chainguard langfuse-fips-3 0 3.160.0-r1
Chainguard langfuse-fips-3-worker 0 3.160.0-r1
Chainguard librechat 0 0.8.3-r0
Chainguard opensearch-dashboards-2 0 2.19.5-r3
Chainguard opensearch-dashboards-2-fips 0 2.19.5-r1
Wolfi langfuse-3 0 3.160.0-r1
Wolfi langfuse-3-worker 0 3.160.0-r1
Wolfi opensearch-dashboards-2 0 2.19.5-r3

Related vulnerabilities